digitalocean @digitalocean/do-markdownit vulnerabilities

Latest digitalocean @digitalocean/do-markdownit CVEs

Newest publication first

1. CVE-2025-59717 @digitalocean/do-markdownit has Type Confusion vulnerability

   Published 2025-09-19

   Critical·CVSS 9.8 EPSS 0.39%

   In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.